Extracted

• • Target

    38f6cc3a62b6f9d95786c4e01a8c4a10N

  • Size

    245KB

  • MD5

    38f6cc3a62b6f9d95786c4e01a8c4a10

  • SHA1

    5c7bf67cd37fa62da6e8d17b4a37f46e3fd672ae

  • SHA256

    5ec3b45abadfbd6902d9deb2c3823aae00af7db5df722777522688242e5ab508

  • SHA512

    bfe1c39f285d36436bf860e315c334ed78c8804fcb696959558a3f83c03e3048997720712a6f017bfdba6059563885dd230a79c7e870b3b675d62e02261902b3

  • SSDEEP

    1536:+XZxPszoZv42CVmxBli4+8Hp3OXC/4cXeXvubKrFEwMEwKhbArEwKhQL4cXeXvuy:+Jxdv423ok8XCwago+bAr+Qka

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2